Re: Set-Cookie and commas in extension attributes
Nick Harper <ietf@nharper.org> Fri, 15 January 2021 06:04 UTC
Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=lists.ie@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EBEE3A0D73 for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Thu, 14 Jan 2021 22:04:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.651
X-Spam-Level:
X-Spam-Status: No, score=-2.651 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.248, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 74nE1ImxVU1w for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Thu, 14 Jan 2021 22:03:58 -0800 (PST)
Received: from lyra.w3.org (lyra.w3.org [128.30.52.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C90883A0D06 for <httpbisa-archive-bis2Juki@lists.ietf.org>; Thu, 14 Jan 2021 22:03:58 -0800 (PST)
Received: from lists by lyra.w3.org with local (Exim 4.92) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1l0IBB-0007St-Qc for ietf-http-wg-dist@listhub.w3.org; Fri, 15 Jan 2021 06:01:49 +0000
Resent-Date: Fri, 15 Jan 2021 06:01:49 +0000
Resent-Message-Id: <E1l0IBB-0007St-Qc@lyra.w3.org>
Received: from mimas.w3.org ([128.30.52.79]) by lyra.w3.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from <nharper@nharper.org>) id 1l0IBA-0007S8-PR for ietf-http-wg@listhub.w3.org; Fri, 15 Jan 2021 06:01:48 +0000
Received: from mail-io1-f42.google.com ([209.85.166.42]) by mimas.w3.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from <nharper@nharper.org>) id 1l0IB9-0008AN-90 for ietf-http-wg@w3.org; Fri, 15 Jan 2021 06:01:48 +0000
Received: by mail-io1-f42.google.com with SMTP id b19so13602644ioa.9 for <ietf-http-wg@w3.org>; Thu, 14 Jan 2021 22:01:46 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=zVDxXNgs0DPqUUdflRvaGpXug/p12eWdK1hD3j2EXXE=; b=keG+JAxZ5UomjTvWAwpHaxQACcZFoztoRWTORz9tzb48iRFcK/VYfWrwDSR8CqxS5J u/hQuhq030mjQ1OxQYSyYQ/cITUQlLW23YYlqXs84nOFFmiwyJnZLeWYAPS0QF3DIlfd qGf+nS4T+5F5v6sSCEKfhPhJA6Fq2yaFWdA/zkJyD9hW0mz/X0XoKa3PgQTOGg7jtJyo FqjCxrdImtFXXwH6hib5yLcgq5fru8kghdhy29BFKcEnt78ixLl3fmw4RkNTF3o4r8gM Tqpcm/dfKPMVD6l2uzn+5ZZ9KkM3Rh5LvSw5kfklUZ2n/8yrjf7aDL460G2xaJPY56UQ mtkQ==
X-Gm-Message-State: AOAM530T+zih8vxtBX6lOQ00SxfS32Pzp6n8Z26lqEvvBXaSA94T6EKb KXzWkGGAG3BIVDImb7hDdJzI7/qq1A3DlOKqrVM5uvTjR1Xlww==
X-Google-Smtp-Source: ABdhPJxqzRFbYbccM2twt8mJ0bb1lbLDBh8To0hb8XncDpxarMYwtEtiDc28hRaqrnv3CH8BAdxxAyBEjPOF8v/qgIA=
X-Received: by 2002:a05:6638:50c:: with SMTP id i12mr9363502jar.74.1610690495935; Thu, 14 Jan 2021 22:01:35 -0800 (PST)
MIME-Version: 1.0
References: <d0db0447-1665-4d7c-90a0-9bcd2c5afc86@www.fastmail.com>
In-Reply-To: <d0db0447-1665-4d7c-90a0-9bcd2c5afc86@www.fastmail.com>
From: Nick Harper <ietf@nharper.org>
Date: Thu, 14 Jan 2021 22:01:25 -0800
Message-ID: <CACcvr==wD9PtNLxruFr355XtrGYb5QB44hnqkWuy7neBLnS0eA@mail.gmail.com>
To: Martin Thomson <mt@lowentropy.net>
Cc: ietf-http-wg@w3.org
Content-Type: multipart/alternative; boundary="000000000000da93be05b8ea1a5c"
Received-SPF: none client-ip=209.85.166.42; envelope-from=nharper@nharper.org; helo=mail-io1-f42.google.com
X-W3C-Hub-Spam-Status: No, score=-3.9
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: mimas.w3.org 1l0IB9-0008AN-90 db150ae4c5783e6c67b7028d05506ff7
X-Original-To: ietf-http-wg@w3.org
Subject: Re: Set-Cookie and commas in extension attributes
Archived-At: <https://www.w3.org/mid/CACcvr==wD9PtNLxruFr355XtrGYb5QB44hnqkWuy7neBLnS0eA@mail.gmail.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/38376
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <https://www.w3.org/Mail/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>
I would imagine that the recipient would only parse the first cookie in the header and the remainder would be treated as unknown extensions and ignored. The following section has a note calling out Set-Cookie and that multiple field lines shouldn’t be combined into one for that particular header. On Thu, Jan 14, 2021 at 9:50 PM Martin Thomson <mt@lowentropy.net> wrote: > Just confirming this, but it appears as though comma is a valid character > in an extension to Set-Cookie. What happens if an intermediary combines > two Set-Cookie header fields as permitted by the core specification[1]? > > [1] > https://httpwg.org/http-core/draft-ietf-httpbis-semantics-latest.html#field.lines > >
- Set-Cookie and commas in extension attributes Martin Thomson
- Re: Set-Cookie and commas in extension attributes Nick Harper
- Re: Set-Cookie and commas in extension attributes Martin Thomson
- Re: Set-Cookie and commas in extension attributes Julian Reschke